A critical OS command injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud allows unauthenticated remote code execution, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog.
What Is It
CVE-2026-110447 is an OS command injection vulnerability (CWE-78) in proxy.php of the Collabora Online Built-in CODE Server (richdocumentscode), a Nextcloud app. The flaw can be triggered when the CODE server isn't running, for example after the product has recently been restarted. NVD says it is a different vulnerability from CVE-2025-66208.
The CNA rates it CVSS 4.0 9.2 (Critical) with the vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. That means an attacker can exploit it over the network with no privileges and no user interaction, as long as a precondition is met.
Why It Matters
CISA added CVE-2026-110447 to the KEV catalog on 2026-10-23, which confirms active exploitation. The NVD description says it was "exploited in the wild in September and October 2026." CISA's SSVC assessment rates exploitation as active, automatable as yes and technical impact as total.
The KEV entry marks the CVE for forensic triage, so organizations should investigate for compromise as well as patch. Known use in ransomware campaigns is listed as Unknown. Federal agencies have a remediation due date of 2026-10-26, only three days after the KEV listing.
What's Vulnerable
- Product: Collabora Online – Built-in CODE Server (
richdocumentscode) used within Nextcloud - Affected versions: all versions before 26.4.303
- Not affected: standalone Collabora Online servers. Only the Nextcloud deployment that uses the built-in CODE Server is vulnerable.
Patch Status
The issue is fixed in richdocumentscode 26.4.303. Nextcloud has posted a community notice urging Built-in CODE users to update as soon as possible.
CISA's required action is to apply mitigations according to vendor instructions and to follow BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations are unavailable, organizations should follow the BOD 26-04 guidance for cloud services or stop using the product. Organizations are responsible for evaluating each asset's internet exposure.
Sources
- CISA KEV Catalog – CVE-2026-110447
- NVD – CVE-2026-110447
- Nextcloud Community – To Collabora Built-in User: Update ASAP
- GitHub Security Advisory GHSA-g3vx-3m76-fghh
- GitHub – richdocumentscode Issue #354
- CISA BOD 26-04 – Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)